Method and apparatus for event diagnosis in a computerized system

Abstract

A method and apparatus for diagnosis of a computerized system, the method comprising the steps of collecting one or more events; transforming the events to events based time series, said events based time series having intervals; determining which resources of the computerized system are being consumed by which events, for a first predetermined time interval; and determining a function between the events based time series and one or more measurable attributes of one or more resources that were consumed by the events for a second predetermined time interval.

1 . A method for diagnosis of a computerized system, the method is implemented within a computing platform, the platform comprises at least one processing unit, at least one storage device; and at least one communication device, the method comprising the steps of:
 collecting at least one event or extracting at least one data element generated by an element of the computerized system;   transforming the at least one event or at least one data element to an at least one event based time series, said at least one event based time series having at least one interval;   determining which at least one resource of the computerized system is consumed by which of the at least one event, for a first predetermined time interval; and   determining a function between the at least one event based time series and an at least one measurable attribute of the at least one resource for the at least one event for a second predetermined time interval.   
     
     
         2 . The method for diagnosis of a computerized system of  claim 1  further comprising a step of storing the at least one event or at least one data element generated by an element of the computerized system in a database. 
     
     
         3 . The method for diagnosis of a computerized system of  claim 1  wherein the first predetermined time interval is longer than or equal to the second predetermined time interval. 
     
     
         4 . The method for diagnosis of a computerized system of  claim 1  wherein said function is a linear function. 
     
     
         5 . The method for diagnosis of a computerized system of  claim 1  wherein said function is a non-linear function. 
     
     
         6 . The method for diagnosis of a computerized system of  claim 1  wherein said measurable attribute comprises any on of the following attributes: time; consumed time; speed; network speed; storage space; available space; space; free space; bit rate byte rate; read or write queue length; average queue length; temporary queue length; read or write time; transfer time; idle time; split i/o; packets; packets received; packets sent; packets per see; bandwidth; received bytes; page faults; available bytes; committed bytes; commit limit; write copies; transition faults; cache faults; demand zero faults; pages input; page reads; pages output: pool paged; pool non paged; page writes; free system page table entries; cache; cache peak; pool paged resident; system code total; system resident code; system total resident; system total driver; packets received; packets sent; packets error; packets unknown; system driver; system resident driver; system resident cache; committed in use; processor time; user time; interrupt; threads; processes; system up time; alignment fixups; exception dispatches; floating emulations; registry quota in use; file read operations; file write operations; file control operations; file read bytes; file write bytes; file control bytes; context switches; system calls; file data operations; system up time; processor queue length; memory page faults; page file sys usage; page file sys peak. 
     
     
         7 . The method for diagnosis of a computerized system of  claim 1  wherein the second predetermined time interval is contained in the first predetermined time interval. 
     
     
         8 . The method for diagnosis of a computerized system of  claim 1  further comprising a step of determining a function between the at least one event based time series and the at least one measurable attribute of the at least one resource for the at least one event for a third predetermined time interval. 
     
     
         9 . The method for diagnosis of a computerized system of  claim 8  wherein the third predetermined time interval is different from the second predetermined time interval. 
     
     
         10 . The method for diagnosis of a computerized system of  claim 1  wherein said step of determining the function between the at least one event based time series and at least one measurable attribute of the at least one resource for the at least one event comprises the use of minimum least square method step. 
     
     
         11 . The method for diagnosis of a computerized system of  claim 11  further comprising the step of iteratively introducing weights into the said step of determining the function between the at least one event based time series and at least one measurable attribute of the at least one resource for the at least one event. 
     
     
         12 . The method for diagnosis of a computerized system of  claims 1  or  22  or  8  or  10  or  11  wherein the event is an event type. 
     
     
         13 . The method of  claims 1  or  8  or  10  or  11  wherein the at least one resource is an at least one consumed resource. 
     
     
         14 . The method for diagnosis of a computerized system of  claim 6  wherein said measurable attribute is measured by any one of the following: per seconds; bytes per seconds; seconds; bytes; bytes length; queue length; packets. 
     
     
         15 . An apparatus for diagnosis of a computerized system, the apparatus is implemented within a computing platform, the platform comprises at least one processing unit, at least one storage device; and at least one communication device, the apparatus comprising:
 a collecting module for collecting information about the computerized system;   a database for storing the information collected by the said collecting module; and   an analyzing module for performing event diagnosis on the information collected by said collecting module and stored by said database.   
     
     
         16 . The apparatus of  claim 15 , further comprising a transforming module for transforming the information stored on said database to a predetermined form to be analyzed by said analyzing module for further processing. 
     
     
         17 . The apparatus of  claim 15 , further comprising a data visualization module for receiving and presenting the results of the event diagnosis performed by said analyzing module. 
     
     
         18 . The apparatus of  claim 16 , further comprising a display module for viewing the results of the event diagnosis received from the said data visualization module. 
     
     
         19 . The apparatus of  claim 14  wherein the event is an event type.